NIST Cybersecurity Framework 2.0 NIST-CSF-ID.RA-05: Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization

What else in your programme already covers this

This control maps to 72 controls across 38 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 6 controls

NIST800-PM-28 PM-28 Risk Framing
NIST800-RA-1 RA-1 Policy and Procedures
NIST800-RA-10 RA-10 Threat Hunting
NIST800-RA-3 RA-3 Risk Assessment
NIST800-RA-5 RA-5 Vulnerability Monitoring and Scanning
SP800-53-RA Risk Assessment Family

PCI DSS 4.0 · 6 controls

11.3.1 11.3.1 Quarterly internal vulnerability scans
11.3.2 11.3.2 Quarterly ASV external vulnerability scans
12.3.2 12.3.2 Targeted risk analysis for each customized-approach requirement
5.3.2.1 5.3.2.1 Targeted risk analysis sets malware scan frequency
5.2.3 5.2.3 Periodic evaluation of components not at risk from malware
6.3.1 6.3.1 Vulnerability identification and risk ranking

CIS Controls v8 · 5 controls

CIS-16.6 Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities
CIS-18.2 Perform Periodic External Penetration Tests
CIS-18.5 Perform Periodic Internal Penetration Tests
CIS-7.5 Perform Automated Vulnerability Scans of Internal Enterprise Assets
CIS-7.6 Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets

ISO/IEC 42001:2023 · 5 controls

6.1.2 AI risk assessment
6.1.4 AI system impact assessment
8.2 AI risk assessment
A.5.2 AI system impact assessment process
A.5.4 Assessing AI system impact on individuals or groups of individuals

APRA CPS 220 Risk Management · 3 controls

CPS220-06 Risk Appetite Statement
CPS220-16 Management Information System and Data Framework
CPS220-P33 Risks Arising from Strategic Objectives and the Business Plan

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 3 controls

CCM-A&A-03 Risk Based Planning Assessment
CCM-GRC-02 Risk Management Program
CCM-TVM-08 Vulnerability Prioritization

ISO 22301:2019 · 3 controls

6.1.2 Addressing risks and opportunities
8.2 Business impact analysis and risk assessment
8.2.3 Risk assessment

APRA CPS 230 Operational Risk Management · 2 controls

CPS230-11 Identification, Assessment and Management of Operational Risk
CPS230-P27 Comprehensive Assessment of the Operational Risk Profile

APRA CPS 234 · 2 controls

CPS234-15 Information Security Capability
CPS234-21 Implementation of Information Security Controls

Australian Information Security Manual · 2 controls

ISM-0009 Identifying supplementary controls
ISM-1203 Threat and risk assessment for each system

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 2 controls

CFTC-SS-1 Program of Risk Analysis and Oversight
CFTC-SS-17 Enterprise Technology Risk Assessment

FedRAMP High · 2 controls

RA-3 Risk Assessment
RA-7 Risk Response

ISO 27001:2022 · 2 controls

5.7 Threat intelligence
8.8 Management of technical vulnerabilities

ISO 27002:2022 · 2 controls

5.7 Threat intelligence
8.8 Management of technical vulnerabilities

ISO 27701:2019 · 2 controls

5.6.2 Information security risk assessment
7.2.5 Privacy impact assessment

NIS2 Directive · 2 controls

Art.21.1 Take proportionate all-hazards measures calibrated to the entity's own risk exposure
Art.21.2.a Policies on risk analysis and on information system security

SOC 2 · 2 controls

SOC2-CC2.1 CC2.1 Relevant, quality information to support internal control (COSO principle 13)
SOC2-CC3.2 CC3.2 Identifying and analysing risks to objectives (COSO principle 7)

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

ANSSI-HYG-41 Conduct a Formal Risk Analysis

APRA SPS 220 Risk Management (Superannuation) · 1 control

SPS220-P11 Assessment of the Materiality of Each Risk

ASEAN Data Management Framework · 1 control

ADMF-4.4 Assign datasets to risk tiers

ASIC Cyber Resilience Good Practices · 1 control

ASIC-CR-RM-1 Intelligence-led cyber risk management

AWS Well-Architected Security Pillar · 1 control

SEC01-BP07 Identify threats and prioritize mitigations using a threat model

Australia Consumer Data Right - Banking (CDR) · 1 control

AUCDR-IS-STEP3 Step 3 - Have and maintain an information security capability

Australia My Health Records Act 2012 · 1 control

MYHR-SEC-5 Security risk assessment

Azure Security Benchmark · 1 control

ASBv3-DS-1 Conduct threat modeling

C5 (Germany) · 1 control

C5-OIS-07 Application of the Risk Management Policy

CMMC 2.0 · 1 control

RA.L2-3.11.1 Risk Assessments

HIPAA Security Rule · 1 control

164.308(a)(1)(ii)(A) Risk Analysis (Required)

NIST Cybersecurity Framework 1.0 · 1 control

ID.RA-5 ID.RA-5: Threats, vulnerabilities, likelihoods, and impacts are used to determine risk

NIST Cybersecurity Framework 1.1 · 1 control

ID.RA-5 ID.RA-5: Threats, vulnerabilities, likelihoods, and impacts are used to determine risk

NIST SP 800-161 Rev 1 · 1 control

161R1-RA-3 Risk Assessment

NIST SP 800-171 Rev 3 · 1 control

03.11.01 Risk Assessment

NIST SP 800-218 · 1 control

SP800-218-PW.1.2 Track Security Requirements, Risks, and Decisions

NIST SP 800-61 Rev. 3 · 1 control

ID.RA-05 ID.RA-05 Existing risk estimation mechanisms used for incident response

NIST SP 800-66 Rev 2 · 1 control

164.308(a)(1)(ii)(A) Risk Analysis (Required)

SEC Cybersecurity Disclosure Rule · 1 control

SEC-CYB-06 Risk Management and Strategy Disclosure

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of NIST Cybersecurity Framework 2.0 have you already done?

NIST Cybersecurity Framework 2.0 NIST-CSF-ID.RA-05 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST Cybersecurity Framework 2.0 your existing evidence covers. Hold ISO 27001:2022 and 73 of 106 NIST Cybersecurity Framework 2.0 controls already carry evidence.

If you hold ISO 27001:202268.9% covered · 33 gaps If you hold NIST SP 800-53 Rev 567.9% covered · 34 gaps If you hold C5 (Germany)67% covered · 35 gaps If you hold FedRAMP Moderate63.2% covered · 39 gaps If you hold ISO 27002:202258.5% covered · 44 gaps If you hold CIS Controls v853.8% covered · 49 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 174 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 each Browse the graph free